topic Re: Multiple Artifacts Causing Multiple Playbook Runs in Splunk SOAR

Multiple Artifacts Causing Multiple Playbook Runs

cmg — Thu, 11 Jan 2024 23:27:27 GMT

When a container is created that contains multiple artifacts from a forwarded Splunk event, I noticed playbooks are running against every artifact that has been added, causing duplicate actions.

Reading through the boards here a bit a possible solution was adding logic to check for a container tag on run. Use a decision block to see if a tag exists, if so simply end, otherwise continue and add a tag when complete.

My problem is this appears to work when testing against existing containers (debug against existing container ID and all artifacts), but when a new container is created it seems to ignore this and run multiple times.

My guess is the playbook is being run concurrently for each of the artifacts instead of one at a time.

1. What is causing the problem?
2. What is best practice to prevent this from occurring?

Re: Multiple Artifacts Causing Multiple Playbook Runs

phanTom — Fri, 12 Jan 2024 11:03:42 GMT

@cmg it sounds like you are getting multiple artifacts in your container upon creation? If there are duplicate actions does that also mean there are duplicate artifact values?

There is a setting in the Splunk App for SOAR Export that will create just 1 artifact rather than multiple duplciates where generally only 1 field is different (if there are Multi Value fields in the results).

Re: Multiple Artifacts Causing Multiple Playbook Runs

cmg — Sat, 13 Jan 2024 00:55:43 GMT

@phanTom

Correct, multiple artifacts in a container upon creation. It looks like there are duplicate values, however the artifact ID is different.

I do have multi-value fields configured (default). Is that where you are suggesting making the change?

Re: Multiple Artifacts Causing Multiple Playbook Runs

phanTom — Mon, 15 Jan 2024 09:10:53 GMT

@cmg yes you should change the setting but be aware values, where there is an MV field, will now come in as lists and you may need to adjust your playbook(s) to handle that.